sp12ct-holvik-biz-fresel-kandor[.]pages[.]dev

The domain sp12ct-holvik-biz-fresel-kandor.pages.dev is presently active and has been classified as a generic phishing infrastructure with an elevated risk rating. Registration data shows the site was provisioned through Cloudflare Pages, indicating the underlying web content is hosted on Cloudflare’s shared platform. Independent security aggregators have placed the domain on two public blocklists, and it is explicitly listed by PhishDestroy and OpenPhish as a malicious resource.

VirusTotal analysis reports that 13 of 91 scanning engines have generated a detection, confirming that a subset of commercial and open‑source scanners recognize the domain as suspicious. No additional intelligence such as Safe Browsing verdicts, OTX tags, SSL details, or HTTP response codes is available in the current dataset, leaving those operational characteristics unverified. Given the convergence of blocklist listings, third‑party detections, and the Cloudflare Pages hosting pattern—which is frequently abused for short‑lived phishing campaigns—defenders should treat traffic to this host as hostile.

Recommended mitigations include adding the domain to firewall deny lists, updating web‑proxy and DNS filtering policies to block resolution, and monitoring for any newly observed connections from internal assets. Continuous re‑evaluation is advised, as the lack of public SSL or response data means further reconnaissance could reveal additional indicators of compromise.